IrelandData Protection Act 2018
Data Protection Act 2018 (No. 7 of 2018)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish and document a lawful basis under General Data Protection Regulation (GDPR) Article 6 before processing any personal data of a person in Ireland.
These lines are LexLint's reading of the law's text. Also read by: Data Protection Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Data Protection Act 2018 sections 144 to 146 create offences separate from the GDPR Article 83 administrative fines regime. Section 144 makes it an offence for a processor, or an employee or agent of a processor, to disclose personal data without the controller's prior authority. Section 145 makes it an offence to obtain personal data without the controller's or processor's authority and then disclose, sell, or offer to sell it. Section 146 extends liability to a director, manager, secretary or other officer of a body corporate where the offence is committed with that person's consent or connivance, or is attributable to that person's neglect. Each offence carries, on conviction on indictment, a fine not exceeding EUR 50,000 or imprisonment for up to 5 years, or both, and on summary conviction a class A fine or imprisonment for up to 12 months, or both.
Penalty structure
GDPR Article 83(5) sets the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover, for infringements including the Article 9 special category rules, the Article 12 to 22 data subject rights, and the Chapter V transfer rules. The lower Article 83(4) tier, up to EUR 10,000,000 or 2% of turnover, applies instead to the Article 25 to 39 controller and processor obligations, including the Article 33 and 34 breach notification duties. Data Protection Act 2018 section 141(4) caps the administrative fine the Commission may impose on a public authority or public body that does not act as an undertaking within the meaning of the Competition Act 2002 at EUR 1,000,000.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
Enforcement record
Counts the large scale statutory inquiries the Data Protection Commission finalised in calendar year 2025 (4), per the Commission's own press release announcing its 2025 Annual Report, published . The fines imposed that year included two fines totalling EUR 530 million against TikTok Technology Limited over transfers of EEA user data to China, and a EUR 550,000 fine against the Department of Social Protection over biometric facial matching in the Public Services Card registration process; the release's own stated total of fines for the year is just over EUR 530.77 million. Public enforcement actions only, counted from the Commission's own announcement rather than a private tracker; the release does not restate a cumulative total since 2018. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Currency
- EUR
- Source link
- https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
- Fines per year
- 530,770,000
- Actions per year
- 4
Settledness
- As of
- Guidance link
- https://www.dataprotection.ie/en/organisations/know-your-obligations/lawful-processing
- Guidance body
- Data Protection Commission
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record, Decision basis, Data lineage
Logging duty
Sections 81 and 82 are in Part 5, which transposes the Law Enforcement Directive and applies under section 70 to processing for the prevention, investigation, detection or prosecution of criminal offences and the execution of criminal penalties, not to the GDPR regime. Section 81 requires a controller and processor to keep a record of processing activities, and section 82 requires a data log of collection, alteration, consultation, disclosure, combination and erasure. For consultation and disclosure the log must show the date and time, the reason, as far as possible who consulted or disclosed, and the recipient. The log may be used only to verify lawfulness, for the controller's or processor's own monitoring, to ensure integrity and security, and in criminal proceedings. Both must be made available to the Commission on request, and section 136 lets the Commission audit a controller or processor to which Part 5 applies.
- Kind
- Explicit
- As of
- Provision
- Data Protection Act 2018, sections 81 and 82
- Trigger
- personal_data_processing
What this law does
The General Data Protection Regulation (GDPR) applies directly in Ireland, and the Data Protection Act 2018 (DPA 2018), No. 7 of 2018, gives it domestic effect: Part 3 supplies Ireland's national derogations and exemptions, Part 2 establishes the Data Protection Commission (DPC) as supervisory authority, and Part 6 supplies the enforcement architecture; Part 5 transposes the Law Enforcement Directive and is not the GDPR regime.
Because most large United States technology companies base their EU headquarters in Ireland, the DPC is the lead supervisory authority under the GDPR one-stop-shop mechanism for most of their cross-border processing, which makes Irish enforcement practice a de facto reference point for the whole EU, including on how existing privacy law reaches AI training uses of personal data.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .